Created
February 7, 2019 10:08
-
-
Save AdityaChaudhary/b9bf4b7f2317c01ea557da04ce6e754e to your computer and use it in GitHub Desktop.
MSFvenom linux/x86/exec Libemu sctool dump
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| graph file linux_x86_exec.dot | |
| verbose = 3 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] cpu state eip=0x00417000 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] eax=0x00000000 ecx=0x00000000 edx=0x00000000 ebx=0x00000000 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] esp=0x00416fce ebp=0x00000000 esi=0x00000000 edi=0x00000000 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] Flags: | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] cpu state eip=0x00417000 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] eax=0x00000000 ecx=0x00000000 edx=0x00000000 ebx=0x00000000 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] esp=0x00416fce ebp=0x00000000 esi=0x00000000 edi=0x00000000 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] Flags: | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] 6A0B push byte 0xb | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] cpu state eip=0x00417002 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] eax=0x00000000 ecx=0x00000000 edx=0x00000000 ebx=0x00000000 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] esp=0x00416fca ebp=0x00000000 esi=0x00000000 edi=0x00000000 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] Flags: | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] 58 pop eax | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] cpu state eip=0x00417003 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] eax=0x0000000b ecx=0x00000000 edx=0x00000000 ebx=0x00000000 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] esp=0x00416fce ebp=0x00000000 esi=0x00000000 edi=0x00000000 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] Flags: | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] 99 cwd | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] cpu state eip=0x00417004 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] eax=0x0000000b ecx=0x00000000 edx=0x00000000 ebx=0x00000000 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] esp=0x00416fce ebp=0x00000000 esi=0x00000000 edi=0x00000000 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] Flags: | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] 52 push edx | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] cpu state eip=0x00417005 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] eax=0x0000000b ecx=0x00000000 edx=0x00000000 ebx=0x00000000 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] esp=0x00416fca ebp=0x00000000 esi=0x00000000 edi=0x00000000 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] Flags: | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] 66682D63 push word 0x632d | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] cpu state eip=0x00417009 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] eax=0x0000000b ecx=0x00000000 edx=0x00000000 ebx=0x00000000 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] esp=0x00416fc8 ebp=0x00000000 esi=0x00000000 edi=0x00000000 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] Flags: | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] 89E7 mov edi,esp | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] cpu state eip=0x0041700b | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] eax=0x0000000b ecx=0x00000000 edx=0x00000000 ebx=0x00000000 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] esp=0x00416fc8 ebp=0x00000000 esi=0x00000000 edi=0x00416fc8 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] Flags: | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] 682F736800 push dword 0x68732f | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] cpu state eip=0x00417010 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] eax=0x0000000b ecx=0x00000000 edx=0x00000000 ebx=0x00000000 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] esp=0x00416fc4 ebp=0x00000000 esi=0x00000000 edi=0x00416fc8 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] Flags: | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] 682F62696E push dword 0x6e69622f | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] cpu state eip=0x00417015 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] eax=0x0000000b ecx=0x00000000 edx=0x00000000 ebx=0x00000000 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] esp=0x00416fc0 ebp=0x00000000 esi=0x00000000 edi=0x00416fc8 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] Flags: | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] 89E3 mov ebx,esp | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] cpu state eip=0x00417017 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] eax=0x0000000b ecx=0x00000000 edx=0x00000000 ebx=0x00416fc0 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] esp=0x00416fc0 ebp=0x00000000 esi=0x00000000 edi=0x00416fc8 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] Flags: | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] 52 push edx | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] cpu state eip=0x00417018 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] eax=0x0000000b ecx=0x00000000 edx=0x00000000 ebx=0x00416fc0 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] esp=0x00416fbc ebp=0x00000000 esi=0x00000000 edi=0x00416fc8 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] Flags: | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] E8 call 0x1 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] cpu state eip=0x00417024 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] eax=0x0000000b ecx=0x00000000 edx=0x00000000 ebx=0x00416fc0 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] esp=0x00416fb8 ebp=0x00000000 esi=0x00000000 edi=0x00416fc8 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] Flags: | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] 57 push edi | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] cpu state eip=0x00417025 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] eax=0x0000000b ecx=0x00000000 edx=0x00000000 ebx=0x00416fc0 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] esp=0x00416fb4 ebp=0x00000000 esi=0x00000000 edi=0x00416fc8 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] Flags: | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] 53 push ebx | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] cpu state eip=0x00417026 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] eax=0x0000000b ecx=0x00000000 edx=0x00000000 ebx=0x00416fc0 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] esp=0x00416fb0 ebp=0x00000000 esi=0x00000000 edi=0x00416fc8 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] Flags: | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] 89E1 mov ecx,esp | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] cpu state eip=0x00417028 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] eax=0x0000000b ecx=0x00416fb0 edx=0x00000000 ebx=0x00416fc0 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] esp=0x00416fb0 ebp=0x00000000 esi=0x00000000 edi=0x00416fc8 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] Flags: | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] CD80 int 0x80 | |
| execve | |
| int execve (const char *dateiname=00416fc0={/bin/sh}, const char * argv[], const char *envp[]); | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] cpu state eip=0x0041702a | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] eax=0x0000000b ecx=0x00416fb0 edx=0x00000000 ebx=0x00416fc0 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] esp=0x00416fb0 ebp=0x00000000 esi=0x00000000 edi=0x00416fc8 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] Flags: | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] 0000 add [eax],al | |
| cpu error error accessing 0x00000004 not mapped | |
| stepcount 15 | |
| copying vertexes | |
| optimizing graph | |
| vertex 0x9e5f3d0 | |
| going forwards from 0x9e5f3d0 | |
| -> vertex 0x9e61570 | |
| -> vertex 0x9e61780 | |
| -> vertex 0x9e61960 | |
| -> vertex 0x9e61a40 | |
| -> vertex 0x9e61cf8 | |
| -> vertex 0x9e61dc8 | |
| -> vertex 0x9e61f30 | |
| -> vertex 0x9e62128 | |
| -> vertex 0x9e62310 | |
| -> vertex 0x9e62488 | |
| -> vertex 0x9e62600 | |
| -> vertex 0x9e62778 | |
| -> vertex 0x9e628f0 | |
| copying edges for 0x9e628f0 | |
| -> 0x9e65c30 | |
| vertex 0x9e62a68 | |
| going forwards from 0x9e62a68 | |
| copying edges for 0x9e62a68 | |
| vertex 0x9e62ee8 | |
| going forwards from 0x9e62ee8 | |
| copying edges for 0x9e62ee8 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] cpu state eip=0x0041702c | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] eax=0x0000000b ecx=0x00416fb0 edx=0x00000000 ebx=0x00416fc0 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] esp=0x00416fb0 ebp=0x00000000 esi=0x00000000 edi=0x00416fc8 | |
| [emu 0x0x9e08090 [31;1mdebug[0m ] Flags: | |
| int execve ( | |
| const char * dateiname = 0x00416fc0 => | |
| = "/bin/sh"; | |
| const char * argv[] = [ | |
| = 0x00416fb0 => | |
| = 0x00416fc0 => | |
| = "/bin/sh"; | |
| = 0x00416fb4 => | |
| = 0x00416fc8 => | |
| = "-c"; | |
| = 0x00416fb8 => | |
| = 0x0041701d => | |
| = "ls -la"; | |
| = 0x00000000 => | |
| none; | |
| ]; | |
| const char * envp[] = 0x00000000 => | |
| none; | |
| ) = 0; |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment